eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
SAN FRANCISCO—At the RSA Security conference, where 40,000-plus attendees are hustling around at the perpetually rebuilding Moscone Center, longtime security software maker and specialized socks provider (pictured) Sophos revealed some research it has done on the so-called “dirty secrets” about using firewalls in enterprise security.
Once upon a time—and it wasn’t that long ago—companies thought all they needed to protect their data was a firewall—a virtualized shield for enterprise data designed to block unauthorized access while permitting outward communication. Here in 2018, security—which has yet to, and may never, determine a real killer app—has become a lot more complicated than simply putting up a wall between good and bad in an enterprise system.
U.K.-based but worldwide-focused Sophos, which has been making various types of firewalls since 1985 and has become sophisticated at doing it, is considered among the world experts in the field. So when it came out April 17 with industry research updating the state of firewalls in the world, it was a piece of work that is significant to a lot of chief information security officers.
The survey polled more than 2,700 IT decision-makers from mid-sized businesses in 10 countries, including the U.S., Canada, Mexico, France, Germany, UK, Australia, Japan, India and South Africa.
IT Managers Don’t Know Half of What’s in Their Networks
Among the findings of its global survey, “The Dirty Secrets of Network Firewalls” (this is a short video), is dirty secret No. 1: IT managers simply cannot identify nearly half (45 percent) of their organization’s network traffic. In fact, nearly 25 percent cannot identify a whopping 70 percent of their network traffic.
These are astounding numbers, especially in view of the fast-increasing amount of data that continues to flow into enterprise storage coffers on a daily basis. If you cannot identify what kinds of data are running through your system’s network veins, you are already at a huge disadvantage.
Obviously, the lack of visibility creates significant security challenges for today’s businesses and impacts effective network management. If you’ve got poison running through your system, there’s no telling what kind of havoc it can wreak.
Considering the debilitating impact cyber-attacks can have on a business, it’s not surprising that 84 percent of respondents reported that a lack of application and data visibility is a serious security concern. Without the ability to identify what’s running on their network, IT managers are blind to ransomware, unknown malware, data breaches and other advanced threats, as well as potentially malicious applications and rogue users.
Why Most Firewalls Are Limited
Another dirty secret: Network firewalls with signature-based detection are unable to provide adequate visibility into application traffic due to a variety of factors such as the increasing use of encryption, browser emulation and advanced evasion techniques.
“If you can’t see everything on your network, you can’t ever be confident that your organization is protected from threats. IT professionals have been ‘flying blind’ for too long and cybercriminals take advantage of this,” Dan Schiappa, senior vice president and general manager of products at Sophos, said in a media advisory. “With governments worldwide introducing stiffer penalties for data breach and loss, knowing who and what is on your network is becoming increasingly important. This dirty secret can’t be ignored any longer.”
On average, organizations spend seven working days remediating 16 infected machines per month, Sophos said. Smaller organizations (100 to 1,000 users) spend on average five working days remediating 13 machines, while larger organizations (1,001-5,000 users) spend on average 10 working days remediating 20 machines per month, according to the survey.
“A single network breach often leads to the compromise of multiple computers, so the faster you can stop the infection from spreading the more you limit the damage and time needed to clean it up,” Schiappa said. “Companies are looking for the kind of next-generation, integrated network and endpoint protection that can stop advanced threats and prevent an isolated incident from turning into a widespread outbreak.
Intelligence Sharing Should Become Standardized
“Sophisticated exploits such as MimiKatz and EternalBlue reminded everyone that network protection is critical to endpoint security and vice versa. Only direct intelligence sharing between these two can reveal the true nature of who and what is operating on your network.”
IT managers know firewalls need an upgrade in protection. In fact, the survey revealed that 79 percent of IT managers polled want better protection from their current firewall. 99 percent want firewall technology that can automatically isolate infected computers, and 97 percent want endpoint and firewall protection from the same vendor which allows for direct sharing of security status information.
Lack of visibility also creates a blind spot for the potential transfer of illegal or inappropriate content on corporate networks, making companies vulnerable to litigation and compliance issues.
“The Dirty Secrets of Network Firewalls” survey results are downloadable here in a PDF format.
Image of Sophos “Stop Ransomware” socks by Chris Preimesberger